As computer networks grow and the amount of data stored on computers and databases interconnected by those networks grows, so have attempts to gain unauthorized access to these computers and databases. Such attempts to gain unauthorized access to computers and databases may include methodical reconnaissance of potential victims to identify traffic patterns and existing defenses. A technique used to gain unauthorized access to computers and databases includes loading malicious software or malware onto a computer. Such malware is designed to disrupt computer operation, gather sensitive information, or to grant access to the computer to unauthorized individuals.
As the awareness of malware increases, the techniques used to load malware onto computers (also called a malware infection) has grown more sophisticated. As a result, legacy security solutions that use a structured process (e.g., signature and heuristics matching) or analyze agent behavior in an isolated context fail to detect sophisticated techniques to load malware. For example, a malware infection may now take multiple steps to redirect a computer to different websites to prevent reputation checking from detecting the infection and use different types of obfuscation and encryption to further prevent pattern matching from detecting the infection.
The failure to detect the loading of malware and sophisticated malware on a computer or network can result in loss of high value data, down time or destruction of infected computers and/or the networks, lost productivity, and a high cost to recover and repair the infected computers and/or networks.